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AMENDMENTS TO THE CLAIMS 

What is claimed is: 

1 . (Currently Amended) A method for automatically analyzing network events, 
comprising: 

generating a matrix that illustrates distance relationships between a plurality of network 
events and a focal event from the plurality of network events or that illustrates distance 
relationships between a plurality of network objects and a focal object from the plurality of 
network objects; and 

automatically analyzing the matrix by evaluating at least one event vector. 

2. (Original) The method o f claim 1 , wherein the matrix is based in part on a 
resource topology or an event topology. 

3. (Original) The method of claim 1, wherein the matrix illustrates connectivity 
relationships among the plurality of network objects. 

4. (Original) The method of claim 1, wherein the matrix illustrates dependency 
relationships among the plurality of network objects. 

5. (Original) The method of claim 1, wherein the matrix illustrates time 
relationships between the plurality of network events and the focal event. 

6. (Original) The method of claim 1, wherein the matrix illustrates a relative 
distance among the plurality of network events or the plurality of network objects. 

7. (Original) The method of claim 1, further comprising: 
filtering the plurality of network events before generating the matrix. 

8. (Original) The method of claim 1, further comprising: 

applying event-specific or object-specific rules or policies to a result of the analysis of the 

matrix. 
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9. (Original) The method of claim 1, wherein the matrix is populated with 
identifiers of the plurality of network objects or identifiers of the plurality of network events. 

10. (Original) The method of claim 1, wherein the at least one event vector is a set of 
network events from the plurality of network events along a path of related network objects from 
the plurality of network objects. 

1 1 . (Original) The method of claim 1, wherein the automatic analyzing comprises a 
sympathetic event reduction, which comprises: 

identifying at least one related event from the plurality of network events; 

correlating the at least one related event to the focal event; and 

hiding at least one redundant sympathetic event from the plurality of network events. 

1 2. (Original) The method of claim 1 , wherein the automatic analyzing comprises a 
dependency analysis, which comprises locating common dependencies among the plurality of 
network objects. 

1 3 . (Original) The method of claim 1 , wherein the automatic analyzing comprises an 
impact analysis, which comprises determining which of the plurality of network objects are 
affected by the focal event. 

14. (Original) The method of claim 1, wherein the automatic analyzing comprises a 
predictive analysis, which comprises determining which of the plurality of network objects 
would be affected by a hypothetical focal event. 

15. (Original) The method of claim 1, wherein the automatic analyzing comprises a 
root cause analysis, which comprises identifying and prioritizing at least one suspected root 
event from the plurality of network events as a potential root cause of the focal event. 

1 6. (Original) The method of claim 1 5, wherein the identifying and prioritizing the at 
least one suspected root event comprises: 

identifying at least one leaf-node event from the plurality of network events; 



70161312.1 



3 



Application No. 10/691,619 

Amendment in Response to Office Action of October 5, 2007 



DocketNo.: 10030598-01 



ranking the at least one leaf-node event according to ranking factors; and 
suppressing each of the plurality of network events that are in the at least one event 

vector and that are not the focal event or the at least one leaf-note event, 

wherein the ranking factors comprise the angle of the at least one event vector, a time 

dispersion along the at least one event vector, and a consistency of event types along the at least 

one event vector. 

17. (Original) The method of claim 1, further comprising: 

displaying the focal event, at least one other event of the plurality of network events, and 
the relationships between the focal event and the at least one other event on a user interface, 

wherein each of the displayed plurality of network events is displayed as one of a 
plurality of network event icons in one of a plurality of colors to indicate event severity, and 
wherein each of the displayed plurality of network event icons is displayed with a clock-like arc 
in one of two colors to represent a time relationship as compared to the focal event. 

18. (Original) The method of claim 17, wherein the displaying is static or dynamic. 

19. (Original) The method of claim 17, wherein only the focal event and at least one 
leaf-node event from the plurality of network events are displayed. 

20. (Original) The method of claim 17, wherein the relationships are illustrated with 
a plurality of lines connecting at least two of the displayed plurality of network events. 

21 . (Original) The method of claim 20, wherein the plurality of lines vary in 
thickness and composition to illustrate rank. 

22. (Currently Amended) A machine-readable medium that provides instructions for 
automatically analyzing network events, which, when executed by a machine, cause the machine 
to perform operations comprising: 

generating a matrix that illustrates distance relationships between a plurality of network 
events and a focal event from the plurality of network events or that illustrates distance 
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relationships between a plurality of network objects and a focal object from the plurality of 
network objects; and 

automatically analyzing the matrix by evaluating at least one event vector. 

23 . (Original) The machine-readable medium of claim 22, wherein the matrix is 
based in part on a resource topology or an event topology 

24. (Original) The machine-readable medium of claim 22, wherein the matrix 
illustrates connectivity relationships among the plurality of network objects. 

25. (Original) The machine-readable medium of claim 22, wherein the matrix 
illustrates dependency relationships among the plurality of network objects. 

26. (Original) The machine-readable medium of claim 22, wherein the matrix 
illustrates 1 time relationships between the plurality of network events and the focal event, 

27. (Original) The machine-readable medium of claim 22, wherein the matrix 
illustrates a relative distance among the plurality of network events or the plurality of network 
objects. 

28. (Original) The machine-readable medium of claim 22, wherein the instructions 
cause the machine to perforin operations further comprising: 

filtering the plurality of network events before generating the matrix. 

29. (Original) The machine-readable medium of claim 22, wherein the instructions 
cause the machine to perform operations further comprising: 

applying event-specific or object-specific rules or policies to a result of the analysis of the 

matrix. 

30. (Original) The machine-readable medium of claim 22, wherein the matrix is 
populated with identifiers of the plurality of network objects or identifiers of the plurality of 
network events. 
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3 1 . (Original) The machine readable medium of claim 22, wherein the at least one 
event vector is a set of network events from the plurality of network events along a path of 
related network objects from the plurality of network objects. 

32. (Original) The machine-readable medium of claim 22, wherein the automatic 
analyzing comprises a sympathetic event reduction, which causes the machine to perform 
operations comprising: 

identifying at least one related event from the plurality of network events; 

correlating the at least one related event to the focal event; and 

hiding at least one redundant sympathetic event from the plurality of network events. 

33. (Original) The machine-readable medium of claim 22, wherein the automatic 
analyzing comprises a dependency analysis, which comprises locating common dependencies 
among the plurality of network objects. 

34. (Original) The machine-readable medium of claim 22, wherein the automatic 
analyzing comprises an impact analysis, which comprises determining which of the plurality of 
network objects are affected by the focal event. 

35. (Original) The machine-readable medium of claim 22, wherein the automatic 
analyzing comprises a predictive analysis, which comprises determining which of the plurality of 
network objects would be affected by a hypothetical focal event. 

36. (Original) The machine-readable medium of claim 22, wherein the automatic 
analyzing comprises a root cause analysis, which comprises identifying and prioritizing at least 
one suspected root event from the plurality of network events as a potential root cause of the 
focal event. 

37. (Original) The machine-readable medium of claim 36, wherein the identifying 
and prioritizing the at least one suspected root event causes the machine to perform operations 
comprising: 
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identifying at least one leaf-node event from the plurality of network events; 

ranking the at least one leaf-node event according to ranking factors; and 

suppressing each of the plurality of network events that are in the at least one event 
vector and that are not the focal event or the at least one leaf-note event, 

wherein the ranking factors comprise the angle of the at least one event vector, a time 
dispersion along the at least one event vector, and a consistency of event types along the at least 
one event vector. 

38. (Original) The machine-readable medium of claim 22, wherein the instructions 
cause the machine to perform operations further comprising: 

displaying the focal event, at least one other event of the plurality of network events, and 
the relationships between the focal event and the at least one other event on a user interface, 

wherein each of the displayed plurality of network events is displayed as one of a 
plurality of network event icons in one of a plurality of colors to indicate event severity, and 

wherein each of the displayed plurality of network event icons is displayed with a clock- 
like arc in one of two colors to represent a time relationship as compared to the focal event. 

39. (Original) The machine-readable medium of claim 38, wherein the displaying is 
static or dynamic. 

40. (Original) The machine-readable medium of claim 38, wherein only the focal 
event and at least one leaf-node event from the plurality of network events are displayed. 

41 . (Original) The machine-readable medium of claim 38, wherein the relationships 
are illustrated with a plurality of lines connecting at least two of the plurality of network events. 

42. (Original) The machine-readable medium of claim 4 1 , wherein the plurality of 
lines vary in thickness and composition to illustrate rank. 
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